Extracted

• • Target
    7e8df85d24aabc66495d12943250999c.exe
  • Size 192KB
  • SHA256 b33f2bc956ec9e983992bd165347b7041b03ee77749640a04451efb3ea2cf5d8
  • MD5 7e8df85d24aabc66495d12943250999c
  • SHA1 a523ec4412d7a8f07d7ef20ad5e250b46fbaae62
  • SHA512 c22d0f8099074f8c28b4fefdd3f5faa40698f6e4c04c30f36de083b1987e915e8bd636fab5cfefe63390233956aacc55e90a502f787af09723fd220cd336f1ce
  • MD5 SHA1 SHA512

  Score

  10^/10

  xloaderitq4loaderratsuricata

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Xloader Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2